DependencyWatch.io
Talk to PrecursorScan a lockfile

Polymarket Trap: fake arbitrage bot leads to a 30-package npm infostealer

HighTyposquatnpm

SafeDep and Panther jointly disclosed the "Polymarket Trap" on 2026-07-17: a fake Trum3it/polymarket-arbitrage-bot GitHub repo (36 stars, 53 forks) whose package.json declares clob-client-math as a peer utility that is never imported. The 30-package cluster spans 10 coordinated npm accounts under two profiles - Polymarket / CLOB SDK impersonators (clob-client-math, polymarket-stake-math, polymarket-trade and siblings) and DeFi-math typosquats (bn-lint, ts-precision, decimal-format-utils). A postinstall hook drops a 2,787–2,887-line JavaScript infostealer that harvests crypto wallets, browser vaults, SSH keys, cloud tokens, and password-manager databases.

Published 17 Jul 2026 · Updated 27 Jul 2026

Check your package-lock.jsonSource advisory
At a glancenpm-2026-07-17-polymarket-trap-clob-client-math
12
Packages tracked29 malicious versions

Every version named by the advisory is in the scanner, so a lockfile check finds it directly.

Severity
High
Type
Typosquat
Published
17 Jul 2026
Last updated
27 Jul 2026
Ecosystems
npm
Detected by
SafeDep, Panther, StepSecurity
Also known as
Polymarket Trap, clob-client-math cluster

Typosquat. A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK.

What happened

The full picture

On 2026-07-17 SafeDep published The Polymarket Trap, tying 30 malicious npm packages spread across 10 coordinated publisher accounts to a single fake GitHub repository - Trum3it/polymarket-arbitrage-bot - that had accumulated 36 stars and 53 forks before a public issue (Trum3it/polymarket-arbitrage-bot#2, filed 2026-06-30) flagged the malicious clob-client-math dependency that was declared but never imported in the bot's source. Panther independently published a version-by-version teardown of the sibling package polymarket-stake-math on the same day.

Delivery: repo → npm install → postinstall dropper → infostealer

The repository advertises a TypeScript bot for Polymarket's 5-minute crypto prediction markets, promising a "late-window resolution snipe" strategy with annual returns above $80,000 - bait tuned for retail DeFi traders. The setup instructions require creating a .env file with POLYMARKET_PRIVATE_KEY BEFORE npm install, so the wallet's raw private key is on disk when the infostealer runs. Nine of the ten npm accounts use a postinstall hook running scripts/install-check.cjs (or the sibling variant scripts/verify-peer.cjs); the tenth uses a delayed require-time dropper. In every variant, the C2 URL is read from the package's homepage field rather than hardcoded in the JavaScript, defeating string-search static analysis on the tarball.

Payload: 2,787–2,887-line JavaScript infostealer

The second stage is a 2,787- to 2,887-line JavaScript infostealer that sweeps crypto wallet vaults (MetaMask, Phantom, Solflare, OKX Wallet, Coinbase Wallet, TrustWallet, Backpack, TronLink), browser cookies and saved passwords (Chrome, Firefox, Brave), developer secrets (SSH private keys, AWS credentials, .npmrc tokens, .pypirc, Docker config, GPG keyrings), shell history (bash/zsh/fish/PowerShell), and password-manager databases (Bitwarden vault export, KeePass .kdbx, 1Password .1pux). Panther traced polymarket-stake-math version escalation: six versions in ~12 hours on 2026-06-23 starting with a clean Kelly-criterion math library, then injecting collector.js in a later version, then in v3.5.0 swapping to a sync-peer.cjs dropper that fetches a pinned payload build (v3.4.0) from the registry and overwrites the installed package files at runtime.

Package profiles

  • Polymarket / CLOB SDK impersonators - clob-client-math, polymarket-stake-math, polymarket-trade, polymarket-bot, polymarket-copy-trading, polymarket-auto-trade, polymarket-claude-code, polymarket-ai-agent. Targets developers wiring up to the legitimate @polymarket/clob-client SDK.
  • Generic DeFi-math typosquats - decimal-format-utils, bn-lint, ts-precision. Targets any project doing decimal math for on-chain balances.

Timeline

  • 2026-05-20 23:30 UTC - First polymarket-* cluster (bot / trade / copy-trading / auto-trade / claude-code / ai-agent) published within a 30-second burst by a throwaway account (early SafeDep write-up: Polymarket npm Packages Steal Crypto Wallet Keys).
  • 2026-06-19 → 2026-06-25 - bn-lint, decimal-format-utils, ts-precision published under sibling accounts.
  • 2026-06-23 19:48 UTC - polymarket-stake-math first version published by npm account haha1999; six versions in the following 12 hours, with the infostealer injected mid-sequence and delivery pivoting to Vercel-hosted C2 the next morning (Panther).
  • 2026-06-29 05:44 UTC - clob-client-math published (unpublished 2026-06-30 by npm-support).
  • 2026-06-30 - Public issue Trum3it/polymarket-arbitrage-bot#2 flags clob-client-math as malicious.
  • 2026-07-17 - SafeDep publishes The Polymarket Trap consolidating the 30-package cluster; Panther publishes matching version-by-version teardown of polymarket-stake-math.

Related tracked activity

A single-package impersonator with an overlapping author profile - polymarket-clob-math@1.0.4, tracked under GHSA-3q5w-m6wr-5jp2 and published 2026-06-27 - is recorded separately as npm-2026-06-27-polymarket-clob-math-vercel-loader because its execution path (install-time Vercel JSON+tarball loader) differs from Polymarket Trap's postinstall dropper family.

typosquatinfostealercredential-theftcrypto-wallet-drain
Affected packages

12 packages 29 versions

These are usually pulled in as transitive dependencies rather than installed directly. Check your whole tree at once. It runs in your browser and nothing is uploaded.

Check package-lock.json →
Impact

What it does if you installed it

  • Cloning the fake Trum3it/polymarket-arbitrage-bot repo and running npm install executes the infostealer - 53 forks each independently triggered the payload before takedown
  • .env files with POLYMARKET_PRIVATE_KEY are on disk BEFORE npm install finishes (per the bot's setup instructions), so the infostealer reads the trading wallet's raw private key on the first install
  • Second-stage infostealer walks crypto wallet vaults (MetaMask, Phantom, Solflare, OKX Wallet, Coinbase Wallet, TrustWallet, Backpack, TronLink); browser cookies + saved passwords (Chrome, Firefox, Brave); SSH private keys; AWS credentials; .npmrc and .pypirc tokens; Docker config; shell history (bash/zsh/fish/PowerShell); password manager databases (Bitwarden vault, KeePass .kdbx, 1Password .1pux)
  • C2 URL is READ FROM THE PACKAGE'S homepage FIELD rather than hardcoded, defeating string-search / static IOC detection on the tarball
  • 9 of the 10 npm accounts share a common scripts/install-check.cjs / scripts/verify-peer.cjs postinstall template - a same-family pattern lockfile scanners can match on the file name once one sample is known
What to do

Clean-up steps

  1. Grep every package.json and lockfile for any of the affected package names; if any of the 10 accounts are pinned, treat every host that ran npm install as fully compromised and rotate credentials from a separate clean device
  2. If you cloned Trum3it/polymarket-arbitrage-bot (or any of Trum3it's other repos, including polymarket-copy-trading-bot): rotate the wallet whose POLYMARKET_PRIVATE_KEY was placed in .env, plus every credential accessible from that host - the infostealer sweeps AWS, npm, PyPI, Docker, SSH, and password-manager vaults in a single pass
  3. Add a lint rule that flags dependencies declared in package.json but never imported / required in source - clob-client-math in the fake repo is present ONLY to trigger its postinstall hook
  4. Enforce scoped-name policies for Polymarket integrations: the LEGITIMATE package is @polymarket/clob-client under the @polymarket scope; unscoped clob-* and polymarket-* names are red flags unless traced to an owned account
  5. Block postinstall execution in CI where possible (npm ci --ignore-scripts) and audit scripts/install-check.cjs / scripts/verify-peer.cjs filenames across your Verdaccio / Nexus / Artifactory tarball cache
References

Sources

npm-2026-07-17-polymarket-trap-clob-client-mathBack to incidentsSubmit a correction
Am I affected?

Check your lockfile against this and every other incident.

Paste a lockfile and it is matched on your own device against every compromised version we track. Nothing is uploaded and there is no account.

Check your package-lock.jsonAll incidents